From patchwork Thu Aug 10 19:54:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13349895 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 64225C41513 for ; Thu, 10 Aug 2023 19:54:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=KIZUN1EK6Gpl2aWvbnQ3Ayd37VVSLySe0rJi7VcyreE=; b=wbX/gb3d7X8/uX ifWzgv81v2yY9Zy50yi/VI5BIMepVsRAV2/gdLVT8YfCpfZNPFe50/LouScwep7UO3Lzl1novBbaW IImoKjqeIRWotNHyngxi6aU2UXo7MaZHpCJj1cld7Cvmk7HEHzZzvOmPcbLFlFT6pOdUPLaSwRoJC I9lzl41K5WpDnTFEoKtascirKhGczDAQ8ExZLLsluB7bPaycKsHWUEWFxy/tOS0+EcErdOJnTOmua 77oyFaHMjLbJgIrKRT6YYgohGi8X05sBBHnQzLDgPMt7Ytqok4Xj+QowS7ilvRbE99Slj/aIpU6qb 3O30y4wXrC5nf99ZRCLg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qUBjw-008bMx-0K; Thu, 10 Aug 2023 19:54:36 +0000 Received: from mail-pg1-x532.google.com ([2607:f8b0:4864:20::532]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qUBjm-008bIQ-0W for linux-arm-kernel@lists.infradead.org; Thu, 10 Aug 2023 19:54:27 +0000 Received: by mail-pg1-x532.google.com with SMTP id 41be03b00d2f7-564cd28d48dso897881a12.0 for ; Thu, 10 Aug 2023 12:54:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1691697265; x=1692302065; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2AzFyigJ847Mx7E2oFBB8SMRyOnv8+4md/Rgc3rIkTY=; b=EhymeSt9AwGdnLF38z1BWoMcYtzxxbOkqvwmhWp/GRcUvwylg9CoK26H1e3AGke8+B RPety8gwpWVVuXWVCYQ3s1K3sd50189fikQk3mSOocuvNuuiO5MVVxnZBq2+8Iy3GSEr GVH5i8CrUQaibx4+voYbDmJYrn6UTF1rIVDow= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691697265; x=1692302065; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2AzFyigJ847Mx7E2oFBB8SMRyOnv8+4md/Rgc3rIkTY=; b=QNvFzmABDq747SaLERN7J1gg71l1uuJ4E+uDvRQ22p3WafihueS3wJeLJjQrkydRsv H+GWnE3pEmqx41bu92cPLZP4dzZJFWxgaKD9dNjjOU9O9O9e0i6MdHgleNWJp04hPhMU XrRv9DDYOGvIaoyNM4uI57jxnFro5c5mVFe9H3si1d3V5p1sttlB6Lrsg0GRHUhQpzFY VadRpTR77OTsWrdKPsHUjrjEk1Oqgfcb0p9E6lnYZ2MbCNYYpnG5Kq3MA2J6k+GgBRRC 6/5LWzTV0mDmOu4+BRYKnytZH8LAa7rPLvyf+nALx/YirAcYTnx5xdHj7cxus+uZhUW0 jz0Q== X-Gm-Message-State: AOJu0YzICEyKH61oW3Ybn+VvVXTBjt7xotZwkEKBWOckjB42f/9SIUHk HUfuy5i7wvp7Wja+PhLVXyUuMvuvDT5jhiBEeHs= X-Google-Smtp-Source: AGHT+IHf7dBPbEfSl1xqIGQRGLihbjGL2keEOoa4x4FFnpIIuQxIh6x560I9zGOiV02ODZa7GkaZmQ== X-Received: by 2002:a05:6a20:4424:b0:140:54ab:7f43 with SMTP id ce36-20020a056a20442400b0014054ab7f43mr4680369pzb.52.1691697265119; Thu, 10 Aug 2023 12:54:25 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id u9-20020a62ed09000000b00668652b020bsm1890241pfh.105.2023.08.10.12.54.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Aug 2023 12:54:22 -0700 (PDT) From: Kees Cook To: Russell King Cc: Kees Cook , Arnd Bergmann , Lecopzer Chen , Oleg Nesterov , linux-arm-kernel@lists.infradead.org, Matthias Brugger , AngeloGioacchino Del Regno , Linus Walleij , Wolfram Sang , Arnd Bergmann , Dan Williams , "Russell King (Oracle)" , linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 1/2] ARM: ptrace: Restore syscall restart tracing Date: Thu, 10 Aug 2023 12:54:18 -0700 Message-Id: <20230810195422.2304827-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230810195141.never.338-kees@kernel.org> References: <20230810195141.never.338-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1376; i=keescook@chromium.org; h=from:subject; bh=PM9VbACsiruUm736SKU4lZ4ZDYtSsZTBmd3nctTMIWk=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBk1UBrSDo2U2GotGsBMY+sQ1nnEqac9N2ubUHNK geMLpezF8yJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZNVAawAKCRCJcvTf3G3A JgEwD/4/PU3jZw0GGsDb1rhpeL2CWa374R86q0eGZC9bP7yNGHj2MZNotCIzG1ln7HnfvVYFEqj ImnJ1VEoF2kur2GameknXgNcAnswvPigS2VhmBQwdreCXLTctILVJ6xaNWv9zI7s/o8S2qRk3jx tLChRFwN5bYukIbOiCVJi0/ZlsEbrkv9KJ28UEoH+l52omPYycquPtuUAyyXjd/xqDSxNe8GHTg QPQTl40snYaEBVFrg4IYKAEqDn3MrTuaQh30+kT0is+AlcENKEFbC83w8dijgS+NDGYtqPW1Pum 9wi3XC+PwGwDRMC2GBeIx/DMCWEE70iElmjUXaljFYAS2/Qn59GFtgeFca3bYN5R9VPBhI1UrBv /guxuT6h9WK0dK80nUqcPeAJyfQt9pOUleFh3lRAEYjCPJF3/eM0JRLofpZ/eJrvoqypt5ON8Vp 90Qs6Yt1qvpF1b1kQqdrGNrG6NR1t1KmrcvoK/FvdJiLQh1uQ/P0sCJsv0sU8HL0XA3/KSORI7L vwl03qLaPkhHsbWxFWQKV+VGlVfniPDjLaDUiFEMiAkAXx3mla223m6DGkZex8RIy7IzHKQiLZ2 6kZsj36XGm95XXJXq84VUgZfPu0oxDYeq5c+v0dlZgj2Vz4UqwZB9lEef1mWbHm8S64fjs1a/g4 2hN+/trZF0WnbKA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230810_125426_206517_3EAC38E8 X-CRM114-Status: GOOD ( 13.18 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Since commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall"), the seccomp selftests "syscall_restart" has been broken. This was caused by the restart syscall not being stored to "abi_syscall" during restart setup before branching to the "local_restart" label. Tracers would see the wrong syscall, and scno would get overwritten while returning from the TIF_WORK path. Add the missing store. Cc: Russell King Cc: Arnd Bergmann Cc: Lecopzer Chen Cc: Oleg Nesterov Cc: linux-arm-kernel@lists.infradead.org Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall") Signed-off-by: Kees Cook Reviewed-by: Arnd Bergmann --- arch/arm/kernel/entry-common.S | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S index bcc4c9ec3aa4..5c31e9de7a60 100644 --- a/arch/arm/kernel/entry-common.S +++ b/arch/arm/kernel/entry-common.S @@ -90,6 +90,7 @@ slow_work_pending: cmp r0, #0 beq no_work_pending movlt scno, #(__NR_restart_syscall - __NR_SYSCALL_BASE) + str scno, [tsk, #TI_ABI_SYSCALL] @ make sure tracers see update ldmia sp, {r0 - r6} @ have to reload r0 - r6 b local_restart @ ... and off we go ENDPROC(ret_fast_syscall) From patchwork Thu Aug 10 19:54:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13349893 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B750FC001DE for ; Thu, 10 Aug 2023 19:54:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=rjseoyAwhGSUnTElaBQj6iYGQCCm1Kp+HBpGbwE0Gnk=; b=4P+4gHMnEARB3T eS56uW8IgYgL7lyJCUfmGj6YxdYTwhonYBCXmKM38XW2ZUVaFXxlkSWQMcHqgS+F9SpCK77ZH2jfO pOrA7kOgrlwBTY8n4jqO8DI73+P6hnROIMv5f7CKxw4ZuqW3bcsw4gqICofExT5+Oom36vGxVGh8R 4JU3Uym66xSjPvqPm9Je5zSs/yi8esrSUFt9FsD/VsC+SV7vlQ1tpiIdMIwscf8RnTjFGtiljkFFo 4eNNUFZmFGgyIO14VP1eQV6sy33zgSKyGEvqvN9bBQnOiA5xxvGzkirhQEIQ7wDi4OOWYeBaHr35x 05QggSCWhPwMDykgzxSQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qUBjm-008bIp-1l; Thu, 10 Aug 2023 19:54:26 +0000 Received: from mail-pl1-x633.google.com ([2607:f8b0:4864:20::633]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qUBjk-008bHS-10 for linux-arm-kernel@lists.infradead.org; Thu, 10 Aug 2023 19:54:25 +0000 Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-1bb893e6365so9942365ad.2 for ; Thu, 10 Aug 2023 12:54:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1691697263; x=1692302063; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=48XwJVsA5wyW9PXqV/vWWiEsWR0pxxYch//gaCXqyTg=; b=B600p5GdQ+dGJFK2CjlcbIfGxqznnTlkVKhTWG0lPs+GsB/Knzz/xcKEKi8/odxuZ0 Z1s80apT3MGBisC29BUKnZrCbQFOxaC5trZf0RmpRDr1Ggq004KPCg/JZYmPL7AAth0Y L+NYoOHQ9W99krwLn2fkTiCj8SYvT6Q+YfJrg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691697263; x=1692302063; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=48XwJVsA5wyW9PXqV/vWWiEsWR0pxxYch//gaCXqyTg=; b=f4mgxA4qtHDNbTGQjTJn8r4F6kM2p3wzVh31rbG0ms1gtypagomxI3L2ddXHr3vByz SWbxhkZt7Ij7OmynGEtQ8jTuGwguc4raoC9XIrKFul3HMwVOquuKJBQj6XMyM5FrZj5n hsKEGgoBKafdZF38Oz9loIj0/xOxCNMuDKMG68U8gwj0s1X2TKq6W/v2rivRm8kr4gu0 DiqC1SC3+mt73hLUvx5giH66Eyr4CynQOMPb1j+jaSFkuNs5uTvaITRzSWGouKRg/It2 Qk1A59UMlM4ke6+PHiD/NuTHY7INUoPGEQZSYTndCtjC0zpA01yz6ESkmQLEbq0y0Gb2 424g== X-Gm-Message-State: AOJu0YwxyOrpDMSgcqmirgqgAQ7QyvcV9gUmvV17+ck/xo+BMjYPEPWh K/uGLvIsUO36HjxiXJuw8X5+1g== X-Google-Smtp-Source: AGHT+IE12uIfTTq88knRn0gncFdLQlCuaARRsIkO0Tck6br3otfYQy5pMeQhjo47X03xSvYmLAj4xQ== X-Received: by 2002:a17:902:c106:b0:1bc:4f04:1803 with SMTP id 6-20020a170902c10600b001bc4f041803mr2898883pli.29.1691697263554; Thu, 10 Aug 2023 12:54:23 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id m7-20020a170902768700b001b9be79729csm2161055pll.165.2023.08.10.12.54.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Aug 2023 12:54:22 -0700 (PDT) From: Kees Cook To: Russell King Cc: Kees Cook , Arnd Bergmann , Lecopzer Chen , Oleg Nesterov , linux-arm-kernel@lists.infradead.org, Matthias Brugger , AngeloGioacchino Del Regno , Linus Walleij , Wolfram Sang , Arnd Bergmann , Dan Williams , "Russell King (Oracle)" , linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 2/2] ARM: ptrace: Restore syscall skipping for tracers Date: Thu, 10 Aug 2023 12:54:19 -0700 Message-Id: <20230810195422.2304827-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230810195141.never.338-kees@kernel.org> References: <20230810195141.never.338-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2072; i=keescook@chromium.org; h=from:subject; bh=oCWnlkmzbAIe4y4dp/g4gh1pykyxBgo3Lt1j/Yzh81Y=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBk1UBroXLDSt36LBKBH3QD1hB/vWj2UTsr5QAof 8bYgVNi7yaJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZNVAawAKCRCJcvTf3G3A JhOSD/9egw+u3pp34j8SsLGazqJO8pUmQ3eoesW1ZAnDfKQWK6+9+qROic8FR4oMNRdG3vBA167 Iete1wjq6L9dXIEP8cnmk9Y6p1X5OTt6lh8rFbMwphF0JngJLxGdOPRb+RItyGPse1e6zjUPJKt sQTT7MSsl7k2U1J3JyYgTPsUvUG9+aJ+sqYnq3ExujVcRDJ0iyHc9MmkuHm/zcGLJicwv6UqcU/ U1ewaZUtURzBPCi6zAZVe2hIoVVpmZ5esGIz/OUAgbbg9xwqq/tWEQtbgdt44SPulMIfYhLrQsA r8IrCKAuYvHj/tcr7uKPwAOKnEk2hXT0EN3RPnrv+CdFeNwFhuMVhJJMRWSXB0RukPOv4XTRyr/ v7pQl3eYKX0fimxJsTBEvxCulx05tA9aP0iXoQwzewliaMiN9oItXQ3JIHnFv5Y6YG0++qI7NXH so8XY0O2jAP4bo/TC6demv4khUn6c+WKL+5IgoVLEk1vXu01rn3MYqCWQ3SyGpIEhu/1jfYJBHw 4z3WoePObVEpi1bGfuJaDpdpwqbo7tlHTg5SIJPc8qE03fGCrSr0OoW64IAhrLmGcDGK4dquONs qx3CT/hY8VcPETTijHzGMizxdZyUpkfg1hvilRLaY2tt1mOxw1QbdrF/umpiU4z4999RR63arEk QWzSNu0rNWdKkYA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230810_125424_370202_5DDFC171 X-CRM114-Status: GOOD ( 16.06 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Since commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall"), the seccomp selftests "syscall_errno" and "syscall_faked" have been broken. Both seccomp and PTRACE depend on using the special value of "-1" for skipping syscalls. This value wasn't working because it was getting masked by __NR_SYSCALL_MASK in both PTRACE_SET_SYSCALL and get_syscall_nr(). Explicitly test for -1 in PTRACE_SET_SYSCALL and get_syscall_nr(), leaving it exposed when present, allowing tracers to skip syscalls again. Cc: Russell King Cc: Arnd Bergmann Cc: Lecopzer Chen Cc: Oleg Nesterov Cc: linux-arm-kernel@lists.infradead.org Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall") Signed-off-by: Kees Cook Reviewed-by: Arnd Bergmann --- arch/arm/include/asm/syscall.h | 3 +++ arch/arm/kernel/ptrace.c | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h index dfeed440254a..fe4326d938c1 100644 --- a/arch/arm/include/asm/syscall.h +++ b/arch/arm/include/asm/syscall.h @@ -25,6 +25,9 @@ static inline int syscall_get_nr(struct task_struct *task, if (IS_ENABLED(CONFIG_AEABI) && !IS_ENABLED(CONFIG_OABI_COMPAT)) return task_thread_info(task)->abi_syscall; + if (task_thread_info(task)->abi_syscall == -1) + return -1; + return task_thread_info(task)->abi_syscall & __NR_SYSCALL_MASK; } diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index 2d8e2516906b..fef32d73f912 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -783,8 +783,9 @@ long arch_ptrace(struct task_struct *child, long request, break; case PTRACE_SET_SYSCALL: - task_thread_info(child)->abi_syscall = data & - __NR_SYSCALL_MASK; + if (data != -1) + data &= __NR_SYSCALL_MASK; + task_thread_info(child)->abi_syscall = data; ret = 0; break;